PaperCut MF CVE-2026-6180

Exploitation requires ALL of the following conditions: (1) PaperCut MF instance deployed with badge-swipe integration to HP multifunction devices; (2) custom badge-ID post-processing scripts enabled on the PaperCut server that transform or map badge strings to user identifiers; (3) specific adverse network conditions (dropped packets, out-of-order sequence counters) affecting communication between device and server during badge swipe; (4) sequence reset notification failure before connection reset completes; (5) authenticated user-level privileges on the PaperCut system (PR:L) or physical access to trigger badge swipes on the MFD; (6) attacker ability to induce or exploit natural network instability (timing-dependent, AT:P). Standard PaperCut badge authentication without custom scripts fails safely with authentication error rather than unauthorized login. Default (non-customized) installations are not vulnerable to unauthorized user login.

CVSS 4.1 with physical attack vector (AV:P) and low attack complexity (AC:L) indicates moderate baseline risk. However, multiple limiting factors substantially reduce real-world exploitation probability: the attack requires specific adverse network conditions (dropped packets, out-of-order sequences, failed reset notifications) that are timing-dependent (AT:P - attacker-triggered), authenticated user-level privileges (PR:L), and custom script deployment - not default configurations. The vulnerability cannot exploit standard badge authentication without post-processing scripts. EPSS score and KEV status not provided, but the combination of AC:L and AT:P suggests exploitation is technically feasible but requires deliberate triggering of network conditions. Organizations without custom badge-ID scripts face authentication failure (low impact) rather than unauthorized login. This is a real but narrow-scope priority affecting only customized PaperCut deployments with specific script configurations and network vulnerability windows.

An attacker with physical access to an HP multifunction device on the same network intentionally triggers network conditions (packet drops via ARP spoofing or congestion) during a badge swipe by a trusted user, causing the PaperCut server to receive fragmented badge data out-of-order with a failed sequence reset. The server truncates the badge ID registration. If custom badge-ID scripts transform the truncated string (e.g., '12345' becomes '54321', mapping to a different user account), the attacker can then swipe their own badge or force a re-authentication attempt that resolves to the legitimate user's session, gaining unauthorized access to that user's print jobs and account settings.